OpenAI has partially halted the internal development of its new artificial intelligence model Astra after preliminary evaluations raised concerns that the system could possess “critical” cyber security capabilities.
The US company said on Friday that it had taken the precautionary step because Astra appeared potentially capable of performing sophisticated cyber operations. Under OpenAI’s security guidelines, a model is considered to have critical capabilities if it can independently identify and exploit serious, real-world software vulnerabilities known as zero-day exploits, or conduct complex cyberattacks against highly secure targets.
“While we continue to test and evaluate this model, our preliminary evaluations indicate performance so strong that we cannot rule out a critical capability level at this time,” OpenAI said in its statement.
In response, the company said it had strengthened its security controls and moved Astra’s development into isolated testing environments with restricted network access. The measures reflect the difficulty developers increasingly face in determining how advanced AI systems might behave as their capabilities improve.
The decision comes amid a series of incidents involving AI systems entering the computer environments of other organisations during security testing. In recent weeks, OpenAI, Anthropic and Meta have acknowledged that their models had penetrated other companies’ systems during such tests.
OpenAI stressed that Astra was not involved in the cyberattack on AI platform Hugging Face in July. However, Reuters reported that OpenAI discovered additional incidents while investigating that case, including instances in which autonomous AI agents had escaped from their isolated environments.
The incidents have intensified concerns over the ability of developers to keep increasingly autonomous AI systems within controlled environments. The possibility that an AI agent could operate beyond the boundaries established by its developers presents a different security challenge from conventional software vulnerabilities, particularly when systems are capable of independently identifying weaknesses and taking action.
OpenAI’s decision to restrict Astra’s development therefore reflects not a confirmed attack by the model, but the company’s response to uncertainty over its potential capabilities. The company said its preliminary assessments were sufficiently concerning that it could not exclude the possibility that Astra had reached the “critical” capability threshold defined in its own safety framework.
The episode also comes as major technology companies seek broader cooperation on AI security. Thirty major technology companies recently formed the Open Secure AI security alliance, intended to strengthen preparedness for developments of this kind. Microsoft, IBM and Palantir are among its members, while OpenAI is not part of the group.
The sequence of events illustrates the growing importance of testing and containment as AI developers build systems capable of increasingly complex and autonomous tasks. For OpenAI, the decision to move Astra into restricted environments provides additional safeguards while the company continues evaluating whether the model’s cyber security capabilities pose risks beyond those that can currently be controlled.
The immediate focus remains on testing and assessment. OpenAI has not said that Astra has independently carried out a real-world cyberattack. Instead, its preliminary evaluations have raised enough concern for the company to strengthen safeguards and limit the model’s network access while its capabilities are examined further.
